registry / @coinbase/cdp-sdk / 1.56.0
@coinbase/cdp-sdk@1.56.0
SDK for interacting with the Coinbase Developer Platform Wallet API
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe credential flow targets the configured CDP service, and the JWT secret pattern is only a placeholder example. Runtime telemetry is disclosed, sent to Coinbase, and has documented opt-outs; the reviewed action event records the action and account type.
Static reason
One or more suspicious static signals were detected.
Trigger
API authentication occurs when SDK operations need it; analytics is triggered by SDK actions or reportable errors.
Impact
No unrelated credential collection, unauthorized account action, or concealed behavior was found.
Mechanism
The RPC helper uses configured credentials to request a token from the configured CDP base path. Analytics sends action or error events to Coinbase’s analytics endpoint, with documented opt-outs.
AI rationale
The credential flow targets the configured CDP service, and the JWT secret pattern is only a placeholder example. Runtime telemetry is disclosed, sent to Coinbase, and has documented opt-outs; the reviewed action event records the action and account type.
Evidence
_cjs/accounts/evm/getBaseNodeRpcUrl.js_cjs/openapi-client/cdpApiClient.js_cjs/analytics.js_cjs/client/evm/evm.jsREADME.md_types/auth/utils/jwt.d.ts
Network endpoints2
api.cdp.coinbase.com/platformcca-lite.coinbase.com/amp
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata identifies this as a Coinbase Developer Platform SDK.
- The Base RPC helper signs a request using configured CDP credentials and the configured CDP API base path.
- Usage events go to Coinbase’s analytics endpoint and track SDK actions such as account creation and account type.
- The README discloses error reporting and usage tracking and documents environment-variable opt-outs; error reports include the error message and stack.
- The JWT declaration’s secret strings are format examples using placeholder values.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
13 flagged_types/auth/utils/jwt.d.tsView file
25patternName = private_key_ec
severity = critical
line = 25
Critical
Critical Secret
Package contains a critical-looking secret pattern.
_types/auth/utils/jwt.d.tsView on unpkg · L2525patternName = private_key_ec
severity = critical
line = 25
Critical
Secret Pattern
EC private key in _types/auth/utils/jwt.d.ts
_types/auth/utils/jwt.d.tsView on unpkg · L25_cjs/x402/account-signers.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
12 Critical1 High2 Medium4 Low
CriticalCritical Secret_types/auth/utils/jwt.d.ts
CriticalSecret Pattern_types/auth/utils/jwt.d.ts
CriticalSecret Pattern_types/auth/utils/http.d.ts
CriticalSecret Pattern_types/auth/utils/ws.d.ts
CriticalSecret Pattern_types/auth/hooks/axios/withAuth.d.ts
CriticalSecret Pattern_types/openapi-client/cdpApiClient.d.ts
CriticalSecret Patternsrc/auth/utils/jwt.ts
CriticalSecret Patternsrc/auth/utils/http.ts
CriticalSecret Patternsrc/auth/utils/ws.ts
CriticalSecret Patternsrc/auth/README.md
CriticalSecret Patternsrc/auth/hooks/axios/withAuth.ts
Critical
Affected versions and remediation
This report applies to @coinbase/cdp-sdk@1.56.0.
See all versions of @coinbase/cdp-sdk for other recorded verdicts.
- Review the evidence and your use of @coinbase/cdp-sdk@1.56.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.